Separate observation from inference

A permission, a possible consequence, and a recorded action are different evidence.

Name the step beyond observation

An observation states what the supplied evidence directly shows. An inference interprets that evidence under assumptions. Reports need both, but readers must be able to tell where the reasoning moves beyond the observed record.

Assume a fictional archive’s approved storage policy permits Finance to read a confidential folder and prohibits grants to Reviewers. This is a configuration review, with no supplied access experiment or historical usage record. Other application restrictions are outside the packet.

Supplied review packet

• O1: The approved policy names Finance as the only group that should receive the folder’s read grant.
• O2: A dated configuration snapshot grants read to both Finance and Reviewers.
• O3: No access history, current group-membership record, or assessment of additional application controls is supplied.

Write the strongest supported claim

O1 and O2 establish a configuration deviation: Reviewers has a grant the policy prohibits. O3 does not erase that mismatch. It limits claims about who could effectively access the folder and whether anyone actually did so.

The potential consequence is access beyond the intended audience if the relevant identity and other access conditions permit it. Label that condition explicitly. Avoid converting a configured permission into “documents were disclosed” or “every reviewer has read the files.”

Request the missing access context only if it is needed to assess exposure or incident history. Keep the original snapshot’s date so later permission changes do not silently rewrite the finding’s evidence.

Model wording: The snapshot grants Reviewers read contrary to policy. Potential exposure requires further access context; historical use was not established.